package com.fs.client.oauth2.authorize;

import java.util.List;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer;
import org.springframework.stereotype.Component;

/** 
* @author pangps
* @version 创建时间：2018年2月1日 下午9:50:27 
* 类说明 
*/
@Component
@Configuration
public class OpenAuthorizeConfigManager implements AuthorizeConfigManager {

	@Autowired
	private List<AuthorizeConfigProvider> authorizeConfigProviders;

	@Value("${server.security.oauth: T}")
	private String auth;

	@Override
	public void config(ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry config) {
		//设置访问
		for (AuthorizeConfigProvider authorizeConfigProvider : authorizeConfigProviders) {
			authorizeConfigProvider.config(config) ;
		}
		if("T".equals(auth)){
			//强制校验token
			config.anyRequest().authenticated() ;
		} else {
			//不需要认证访问
			config.anyRequest().permitAll();
		}

//		if(rbacService!=null){
//// 			放开则全部可以不需要认证访问
// 			config
// 			.anyRequest()
// 				.access("@rbacService.hasPermission(request, authentication)");
//		}

	}

}
